In GoFiber versions <3.3.0 and <=2.52.13, the BalancerForward proxy helper uses the Header.Add() method to insert the X-Real-IP header, appending the real client IP to any existing X-Real-IP header instead of replacing it. Because many upstream HTTP servers (e.g., nginx, Express) use the first X-Real-IP header value for IP-based logic, an attacker can supply a spoofed X-Real-IP header that is used preferentially. This leads to IP spoofing in logging, rate limiting, access control, and geolocation enforcement. The fix is to replace Header.Add() with Header.Set() to ensure only the real client IP is forwarded.

This vulnerability allows attackers to spoof the X-Real-IP header, causing upstream servers to use the attacker-supplied IP for critical functions. This can bypass IP-based rate limiting, IP allowlists (such as internal network restrictions), and geolocation controls. Additionally, audit logs may record false IP addresses, complicating incident response and forensic analysis. There is no direct confidentiality or availability impact reported.

A fix is available by replacing the Header.Add() call with Header.Set() in the BalancerForward proxy helper to ensure the X-Real-IP header is overwritten rather than appended. Users should upgrade to GoFiber version 3.3.0 or later, or any version later than 2.52.13 where this issue is resolved. Until patched, users should avoid relying on the X-Real-IP header from BalancerForward or implement additional validation upstream.